What are Tactics, Techniques and Procedures (TTPs)?

Understanding the TTP hierarchy

Each layer of the TTP model operates at a different level of abstraction. Together they form a complete picture of an intrusion, from strategic intent down to specific attacker actions.

Tactics: the "why"

A tactic is an adversary's immediate technical objective at a given stage of an attack. It answers what the attacker is trying to accomplish, for example gaining initial access, escalating privileges, evading defenses, or exfiltrating data. Tactics are intentionally high-level, describing a category of goal rather than a specific method, and many threat groups are recognizable by their preferred tactics.

Techniques: the "how"

A technique is the method used to achieve a tactic. Techniques are more granular: spear phishing to achieve initial access, or process injection to achieve privilege escalation or defense evasion. They describe methodology rather than a specific tool, which is why they remain useful even as an attacker's toolkit changes. Many techniques have sub-techniques that describe even more specific variants.

Procedures: the "how exactly"

A procedure is the specific, documented implementation an adversary uses to carry out a technique. For example, using PowerShell to inject into lsass.exe and scrape LSASS memory for credentials is a procedure. Procedures are the most detailed layer and often the most revealing, because forensic reconstruction of them can attribute an attack to a known threat group.

Procedures tend to be extensive but frequently repeated, since threat actors document and reuse the exact sequences that work for them. Security analysts reconstruct procedures by analyzing network and event logs, examining modifications to system files, clues in event logs, and the tools and infrastructure changes leading up to an anomalous incident, to build a timeline of the attack. In MITRE ATT&CK, real-world procedures are captured in the "Procedure Examples" section of each technique page, giving defenders concrete implementation detail to detect against.

TTP examples: from tactic to procedure

TTPs and the MITRE ATT&CK framework

The term TTP originated in military intelligence, where understanding an adversary's patterns of behavior was considered more durable than knowing which weapon they used. In cybersecurity, MITRE ATT&CK turned that idea into a standardized, globally used knowledge base. It organizes adversary behavior into tactic categories, each populated with techniques and sub-techniques drawn from real-world observations. The enterprise matrix spans stages such as:

• Initial Access, Execution, Persistence, and Privilege Escalation
• Defense Evasion, Credential Access, Discovery, and Lateral Movement
• Collection, Command and Control, Exfiltration, and Impact

This shared taxonomy gives defenders a common language: an analyst in one organization can describe an intrusion using the same technique IDs, for example T1566 for phishing or T1055 for process injection, as an analyst anywhere else, enabling consistent detection engineering, coverage mapping, and threat intelligence sharing. The National Institute of Standards and Technology (NIST) (SP 800-150) similarly promotes structured TTP sharing to improve collective security posture.

Why attackers use specific TTPs: understanding motivation

TTPs flow from an adversary's motivation, and understanding the "who" and "why" helps defenders anticipate the "how." Broadly, cyber attacks are driven by a handful of motives, each associated with characteristic behaviors:

• Financial gain: The most common driver, behind banking trojans, ransomware, and data theft for resale. These actors are often indifferent to who the target is.
• Espionage: Nation-state and Advanced Persistent Threat (APT) groups stealing intelligence or intellectual property, typically patient and stealthy, favoring living-off-the-land and long dwell times.
• Disruption and hacktivism: Ideologically motivated actors seeking to damage or expose, often via distributed denial of service (DDoS) attacks or wipers.
• Cyber terrorism: Attacks on critical services intended to cause harm and fear in service of a political or military agenda.
• Insider and personal motives: Malicious insiders who already hold access and act out of revenge or personal cause.
• Notoriety: Lower-skilled actors using off-the-shelf kits, seeking attention rather than a specific payoff.

Profiling an adversary by motivation and characteristic TTPs lets defenders build a threat profile, predict likely next stages, and prioritize the countermeasures that matter most for their specific risk environment.

TTPs across the Cyber Kill Chain

TTPs map naturally onto the Cyber Kill Chain, the sequence of stages an intrusion typically follows. Viewing behavior through this lens helps teams understand where in an attack a given technique appears and where detection is most valuable:

• Reconnaissance: Scanning and information gathering to identify entry points.
• Delivery and exploitation: Phishing, exploit delivery, and initial code execution.
• Installation and persistence: Establishing footholds and maintaining access.
• Command and control: Establishing covert channels to direct compromised hosts.
• Actions on objectives: Lateral movement, data collection, exfiltration, or destructive impact.

A sophisticated adversary aims to remain undetected, making only subtle changes until a payload is delivered or data is exfiltrated. Because each stage leaves a distinguishable behavioral footprint, TTP-aware defenders can detect and interrupt an attack at the earliest possible point rather than discovering it after the damage is done.

How TTPs are used in real-world attacks

Threat actors reuse TTPs that work, favoring efficiency over innovation. Understanding the most common ones lets defenders anticipate the next move rather than react to it.

Social engineering

The psychological manipulation of people into divulging information or taking unsafe actions. Beyond phishing and spear phishing, associated techniques include pretexting (using a fabricated scenario), impersonating a trusted party, and watering-hole attacks that compromise sites the target frequents.

Exploiting vulnerabilities

Attackers exploit software or hardware flaws to gain access or escalate privileges. Related techniques include scanning for unpatched systems, zero-day exploitation, remote code execution, and privilege escalation through misconfigurations.

Living off the land (LotL)

Using legitimate, built-in tools to blend in and evade detection. PowerShell abuse, Windows Management Instrumentation (WMI) abuse, scripting-language abuse, fileless malware, and masquerading are hallmark LotL techniques. They're precisely why behavior-based detection matters more than signatures here.

Lateral movement

Once inside, adversaries move between systems to reach high-value targets. Techniques include pass-the-hash and pass-the-ticket, RDP hijacking, credential theft and brute force, and Active Directory exploitation. Lateral movement is a critical mid-attack behavior that TTP-based detection can catch before exfiltration occurs.

Data exfiltration and covering tracks

At the objective stage, attackers compress and encrypt stolen data, tunnel it through trusted protocols such as DNS or HTTPS, obfuscate file formats, and delete logs or deploy rootkits to hide their presence and frustrate forensics.

TTPs vs. Indicators of Compromise (IoCs)

TTPs and IoCs are complementary layers of threat intelligence, but they differ fundamentally in durability and detection value.

Because TTP-based detection fires on behavioral patterns inherent to the attack method, it can catch intrusions during techniques like lateral movement or privilege escalation, well before the most damaging phases, compressing mean time to detect (MTTD). IoC-based detection can only fire after an attack's artifacts have been cataloged, leaving novel malware or LotL attacks to slip through.

Why TTP analysis matters: benefits for defenders

Studying adversary TTPs turns raw observation into actionable defense. The main benefits for a security program include:

• Enhanced threat detection: Behavioral rules and signatures that spot malicious activity regardless of tooling.
• Proactive threat hunting: Anticipating attack paths and actively searching for known adversary behaviors.
• Adversary attribution: Linking activity to specific groups via distinctive procedural artifacts.
• Faster incident response: Recognizing the tactics and techniques in play to scope and contain an incident quickly.
• Prioritized investment: Focusing resources on the threats most relevant to your industry and region.
• Stronger collaboration: Sharing TTPs and IoCs across teams and peers using a common framework.

Beyond these direct benefits, TTP analysis strengthens the wider security program. It informs security awareness training with real-world attack patterns, feeds behavioral baselining and anomaly detection, and supports campaign correlation, linking otherwise isolated incidents across targets, industries, and geographies through shared techniques. Because procedures are consistent enough to act as behavioral signatures, analysts can build composite profiles of intrusion sets and track how a given threat actor's methods evolve over months or years, even as their infrastructure and malware change.

How to defend against common TTPs

Defending against TTPs is continuous, not a one-time task, because adversaries constantly refine their behavior. An effective program blends proactive and reactive controls:

• Adopt a security framework such as the NIST Cybersecurity Framework or the Center for Internet Security (CIS) Controls, and review it regularly.
• Run continuous training and awareness to counter social engineering and phishing.
• Maintain patch management and vulnerability scanning to shrink the exploitable attack surface.
• Apply network segmentation and Zero Trust to limit lateral movement and privilege abuse.
• Deploy behavior-based monitoring via Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platforms mapped to MITRE ATT&CK for 24/7 detection and response.
• Enforce strong identity and access management, as attackers increasingly rely on credentials and privileged access.

Expert insight: TTP detection at scale, the CTI-led way

Detecting adversaries by their behavior only works if your detection library keeps pace with how attackers actually operate. Sekoia's approach is built around exactly that. Its Threat Detection & Research (TDR) team maintains a rules catalog with close to a thousand detection rules mapped to the MITRE ATT&CK matrix, continuously updated as the framework evolves and as new TTPs emerge in the wild.

This matters because attackers frequently reuse TTPs, but also because some techniques resist generic detection. A recent example is the ClickFix social-engineering tactic, which tricks users into copying and running malicious PowerShell from fake browser error messages. Detecting it reliably across diverse, hybrid customer environments requires more than common host and network events. Sekoia's detection engineering combines SIGMA-based behavioral correlation with an actionable Cyber Threat Intelligence (CTI) engine, so coverage extends to techniques that signature-based tools miss. As a European vendor, Sekoia pairs this behavior-first, ATT&CK-aligned detection with a data sovereignty posture that addresses requirements US generalists rarely offer, converting TTP intelligence into detections as soon as adversary behavior shifts.

‍

Frequently asked questions